Security Analyst II

Lockton•Overland Park, KS

About The Position

Lockton is seeking an experienced Security Compliance Analyst II to help operate and mature its security compliance program. The role manages recurring audits and assessments, coordinates evidence and responses, educates control owners, and serves as a knowledgeable liaison with auditors, clients, and internal stakeholders. The successful candidate combines practical audit-cycle experience with strong communication, organization, and business judgment. The analyst supports compliance initiatives and the ongoing development of controls toward repeatable, measurable, and increasingly continuous monitoring practices. The role also contributes to cybersecurity policies, standards, and procedures; prepares client security questionnaire responses; participates in client and prospective-client discussions; reviews security and compliance language in contracts when needed; and stays current on relevant compliance expectations, audit practices, and industry developments. Success is demonstrated through disciplined audit execution, high-quality and timely evidence, informed and accountable control owners, clear auditor and client communication, effective issue follow-through, and continuous improvement of compliance and client-assurance processes.

Requirements

3–5 years of experience in cybersecurity compliance, information security governance, technology risk, IT audit, or a closely related field.
Demonstrated experience managing or coordinating audit cycles from planning through final response and remediation tracking.
Experience working directly with internal or external auditors, including evidence requests, walkthroughs, follow-up questions, and issue resolution.
Experience translating control requirements into clear expectations for technical and business control owners.
Experience preparing responses to client security questionnaires, due-diligence requests, or customer assurance inquiries.
Working knowledge of security controls, risk concepts, audit evidence, and common cybersecurity compliance frameworks or assurance programs.
Excellent written and verbal communication skills, including the ability to explain security and compliance topics to technical, business, client, and audit audiences.
Strong organizational and project-management skills, with the ability to manage multiple workstreams, deadlines, dependencies, and stakeholders.
Ability to self-direct, prioritize tasks independently, and deliver high-quality results under tight deadlines.
Sound judgment and discretion when handling confidential, sensitive, or restricted information.
Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Business, Risk Management, or a related field, or equivalent practical experience.

Nice To Haves

Experience reviewing cybersecurity, privacy, audit, or compliance provisions in contracts and customer agreements.
Experience supporting SOC 2, HITRUST, ISO 27001, NYDFS, or comparable security compliance and assurance activities.
Experience with governance, risk, and compliance platforms; evidence repositories; questionnaire-response tools; or workflow and ticketing systems.
Professional certification such as CISA, CRISC, CISSP, CISM, CCSK, or a comparable audit, risk, or security credential.
Experience in a client-facing role within a regulated, professional-services, financial-services, insurance, or similarly complex environment.

Responsibilities

Manage end-to-end audit and assessment cycles, including planning, scoping, request tracking, evidence coordination, status reporting, walkthroughs, issue follow-up, and closure.
Coordinate evidence collection with control owners and assess submissions for completeness, accuracy, quality, and alignment with control requirements.
Educate and coach control owners on control intent, evidence expectations, testing approaches, recurring deadlines, and sustainable compliance practices.
Serve as a day-to-day contact for internal and external auditors by coordinating meetings, clarifying requests, facilitating walkthroughs, and tracking open questions and commitments.
Support compliance initiatives and the evolution of controls toward repeatable, measurable, and increasingly continuous monitoring practices.
Maintain compliance documentation, including control narratives, evidence inventories, testing records, remediation plans, procedures, and management-ready status reports.
Identify control gaps, evidence weaknesses, and process inefficiencies; partner with control owners and technology teams on remediation and monitor progress.
Contribute to the development, review, and maintenance of cybersecurity policies, standards, and procedures.
Prepare responses to client security questionnaires and inquiries about Lockton’s security program, controls, assurance activities, and risk-management practices.
Participate in client and prospective-client discussions, clearly presenting security and compliance information while appropriately managing sensitive or restricted information.
Partner with Information Security, Information Technology, Legal, Privacy, Risk, and business stakeholders on projects and communicate compliance impacts and obligations.
Maintain and improve approved response content, supporting documentation, and reusable materials for client assurance activities.
Review security and compliance language in contracts, addenda, and customer requirements when needed; identify concerns and coordinate feedback with Legal and relevant subject-matter experts.
Stay current on relevant cybersecurity compliance expectations, audit practices, and industry developments.